OpenClaw versions prior to 2026.5.18 contain a vulnerability where the shell wrapper argument vector (argv) can change between approval and execution. This discrepancy allows a command shape to be executed that was not originally checked against the allowlist, potentially bypassing intended command restrictions. The vulnerability affects the shell wrapper feature and depends on operator configuration and input trust boundaries. The issue does not alter OpenClaw's trusted-operator model but requires careful policy and approval management. A fix is available starting with version 2026.5.18.